Groups | Search | Server Info | Keyboard shortcuts | Login | Register [http] [https] [nntp] [nntps]

Groups > linux.debian.user > #228017

Re: rsync --delete

Show all headers | View raw

On Mon, Oct 19, 2020 at 08:11:01PM -0700, David Christensen wrote:
> On 2020-10-19 05:00, Greg Wooledge wrote:
> > using an explicit /usr/bin/rsync is sketchy at best.  You
> > should already have /usr/bin in your PATH
> 
> AIUI using absolute paths for tools in shell scripts is a security best
> practice -- it helps defend against attacks where PATH is compromised and/or
> trojaned system tools are inserted into directories at the front of PATH.

It's not "best practice", and it does not provide any security against
a malevolent execution environment.  All it really does is introduce
failures when the location of a tool changes.  (See all the instances
of failures when new buster installations moved some tools from /bin
to /usr/bin, and scripts were updated to use things like /usr/bin/mkdir,
which then fails on *upgraded* buster systems.)

To illustrate why it doesn't provide any security protection:

unicorn:~$ function /bin/rm { echo "haha loser"; }
unicorn:~$ /bin/rm xyzzy
haha loser

Remember, bash can accept functions that are imported from the environment,
and bash's functions have an extremely liberal allowed set of characters.

Granted, that same feature/problem will not apply to non-bash scripts,
but even with a #!/bin/sh shebang, it's still common for systems to
have /bin/sh -> bash (even on Debian, it is a supported configuration).

> Using absolute paths for tools also means that the script will work when
> cron(8) runs it (or runs something that runs it).

You can set PATH at the top of the script.

In any case, /usr/bin should be in PATH, even in the most barebones cron
environment.  On Debian, crontab(5) says:

       Several environment variables are set up automatically by  the  cron(8)
       daemon.  SHELL is set to /bin/sh, and LOGNAME and HOME are set from the
       /etc/passwd  line  of  the   crontab's   owner.    PATH   is   set   to
       "/usr/bin:/bin".   HOME,  SHELL, and PATH may be overridden by settings
       in the crontab; LOGNAME is the user that the job is running  from,  and
       may not be changed.

Back to linux.debian.user | Previous | Next — Previous in thread | Next in thread | Find similar | Unroll thread

Thread

rsync --delete Mike McClain <mike.junk.46@att.net> - 2020-10-17 00:30 +0200
  Re: rsync --delete Klaus Singvogel <deb-user-ml@singvogel.net> - 2020-10-17 00:40 +0200
    Re: rsync --delete Greg Wooledge <wooledg@eeg.ccf.org> - 2020-10-19 13:40 +0200
  Re: rsync --delete ellanios82 <ellanios82@gmail.com> - 2020-10-17 00:40 +0200
  Re: rsync --delete Charles Curley <charlescurley@charlescurley.com> - 2020-10-17 04:10 +0200
  Re: rsync --delete Will Mengarini <seldon@eskimo.com> - 2020-10-17 08:40 +0200
    Re: rsync --delete Greg Wooledge <wooledg@eeg.ccf.org> - 2020-10-19 13:50 +0200
  Re: rsync --delete <tomas@tuxteam.de> - 2020-10-17 10:40 +0200
    Re: rsync --delete David <bouncingcats@gmail.com> - 2020-10-17 14:20 +0200
      Re: rsync --delete <tomas@tuxteam.de> - 2020-10-17 15:30 +0200
    Re: rsync --delete Mike McClain <mike.junk.46@att.net> - 2020-10-17 20:30 +0200
      Re: rsync --delete Greg Wooledge <wooledg@eeg.ccf.org> - 2020-10-19 13:50 +0200
    Re: rsync --delete Andrei POPESCU <andreimpopescu@gmail.com> - 2020-10-18 12:50 +0200
  Re: rsync --delete Andy Smith <andy@strugglers.net> - 2020-10-17 17:30 +0200
  Re: rsync --delete David Christensen <dpchrist@holgerdanske.com> - 2020-10-18 00:10 +0200
    Re: rsync --delete Mike McClain <mike.junk.46@att.net> - 2020-10-19 01:40 +0200
    Re: rsync --delete Greg Wooledge <wooledg@eeg.ccf.org> - 2020-10-19 14:00 +0200
      Re: rsync --delete Mike McClain <mike.junk.46@att.net> - 2020-10-19 21:10 +0200
        Re: rsync --delete Greg Wooledge <wooledg@eeg.ccf.org> - 2020-10-19 21:20 +0200
          Re: rsync --delete Tixy <tixy@yxit.co.uk> - 2020-10-19 23:20 +0200
            Re: rsync --delete David Christensen <dpchrist@holgerdanske.com> - 2020-10-20 05:10 +0200
              Re: rsync --delete Tixy <tixy@yxit.co.uk> - 2020-10-20 09:30 +0200
                Re: rsync --delete David <bouncingcats@gmail.com> - 2020-10-20 10:00 +0200
                Re: rsync --delete Tixy <tixy@yxit.co.uk> - 2020-10-20 10:20 +0200
              Re: rsync --delete Andrei POPESCU <andreimpopescu@gmail.com> - 2020-10-20 11:10 +0200
        Re: rsync --delete David <bouncingcats@gmail.com> - 2020-10-19 23:20 +0200
      Re: rsync --delete David Christensen <dpchrist@holgerdanske.com> - 2020-10-20 05:20 +0200
        Re: rsync --delete David <bouncingcats@gmail.com> - 2020-10-20 06:10 +0200
          Re: rsync --delete Nicolas George <george@nsup.org> - 2020-10-20 12:10 +0200
        Re: rsync --delete Greg Wooledge <wooledg@eeg.ccf.org> - 2020-10-20 13:50 +0200
          Re: rsync --delete The Wanderer <wanderer@fastmail.fm> - 2020-10-20 14:50 +0200
            Re: rsync --delete Greg Wooledge <wooledg@eeg.ccf.org> - 2020-10-20 15:10 +0200
              Re: rsync --delete The Wanderer <wanderer@fastmail.fm> - 2020-10-20 15:50 +0200
                Re: rsync --delete Greg Wooledge <wooledg@eeg.ccf.org> - 2020-10-20 16:10 +0200
    define (or translate, or substitute for) "interpolate": Re: rsync --delete rhkramer@gmail.com - 2020-10-19 14:30 +0200
      Re: define (or translate, or substitute for) "interpolate": Re: rsync --delete rhkramer@gmail.com - 2020-10-19 14:50 +0200
      Re: define (or translate, or substitute for) "interpolate": Re:  rsync --delete <tomas@tuxteam.de> - 2020-10-19 15:00 +0200
        Re: define (or translate, or substitute for) "interpolate": Re: rsync --delete rhkramer@gmail.com - 2020-10-20 02:10 +0200
          Re: define (or translate, or substitute for) "interpolate": Re: rsync  --delete David Christensen <dpchrist@holgerdanske.com> - 2020-10-20 05:50 +0200
  Re: rsync --delete Greg Wooledge <wooledg@eeg.ccf.org> - 2020-10-19 14:10 +0200

csiph-web